If you're going to the effort to run a CA, why not also run DNS? I say this as a guy who runs an internal CA and eventually just implemented LE due to all the

If you're going to the effort to run a CA, why not also run DNS? I say this as a guy who runs an internal CA and eventually just implemented LE due to all the problems with trusting internal CAs and getting that to work across all devices.